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Abstract —Secrecy issues of free-space optical links realizing 
information theoretically secure communications as well as high 
transmission rates are discussed. We numerically study secrecy 
communication rates of optical wiretap channel based on on- 
off keying modulation under typical conditions met in satellite- 
ground links. It is shown that under reasonable degraded 
conditions on a wiretapper, information theoretically secure 
communications should be possible in a much wider distance 
range than a range limit of quantum key distribution, enabling 
secure optical links between geostationary earth orbit satellites 
and ground stations with currently available technologies. We 
also provide the upper bounds on the decoding error probability 
and the leaked information to estimate a necessary code length 
for given required levels of performances. This result ensures 
that a reasonable length wiretap channel code for our proposed 
scheme must exist. 

Index Terms —Physical layer security, free space optical com¬ 
munication, secrecy capacity, finite-length analysis. 

I. Introduction 

Free-space optical (FSO) communication is a promising 
technology for high-data-rate wireless networks, such as data 
links between satellites and ground stations m, El, a, El, 
ad hoc trunk link not bounded by fiber networks 0, and the 
“last mile” link from the fiber backbone to the client premises 
0 . 

The high directionality of laser beam can make FSO com¬ 
munications more secure than RF ones. However, it has been 
shown in 0, ® that FSO communications can still suffer 
from optical tapping risks, especially when the main lobe 
of laser beam is considerably wider than the receiver size, 
which is the case for optical links between moving terminals, 
and also between satellites and ground stations. To establish 
the secrecy of confidential data communications, symmetric 
key cryptography is often used with a preshared secret key 
or a key exchanged via public key cryptosystems. These 
crypto-schemes are based on mathematical problems which 
are practically impossible to solve using current computer 
resources. Its security is often referred to as computational 
security. 
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Recently, an approach based on physical layer security 
attracts much attention as an alternative mechanism. This 
is based on an appropriate coding technique designed by 
considering physical properties of the channels, i.e., the main 
channel between the sender (Alice) and the legitimate re¬ 
ceiver (Bob), and the wiretapper channel from Alice to an 
eavesdropper (Eve). This coding is particularly called the 
wiretap channel coding a, cni, and realizes the two functions 
at the same time in the physical layer; the reliability for 
Bob and the secrecy against Eve. The secrecy ensured by 
this paradigm is referred to as information theoretic security 
(ITS), which can be everlasting, in the sense that it can be 
proved that Eve cannot obtain meaningful information even by 
unforeseen mathematical insights or by off-line attacks with 
future advanced computers. 

Studies so far on physical layer security in wireless channels 
and system architecture issues are nicely reviewed in CD. 
An information-theoretically secure key exchange protocol 
over quasi-static wireless channels was proposed with a near- 
optimal LDPC (low density parity check)-based reconciliation 
method over a wide range of signal-to-noise ratios (SNRs) 
d- Physical layer security of ESO communications has been 
discussed in d, proposing a secret key agreement over 
fading channels with reciprocity, and clarifying dominating 
factors on the secret key rate. In 1141 . analysis was made on 
likely wiretap scenarios and influences to secure ESO commu¬ 
nication performances, in terms of the outage probability of 
non-zero secrecy capacity. Mostafa and Lampe studied physi¬ 
cal layer security for indoor visible light communications ua, 
and showed that secrecy rates can be increased by utilizing 
Eve’s channel state information (CSI) via null-steering, or by 
adding artificial noises when Eve’s CSI is not available. 

An extreme example of physical layer security has been 
already realized in quantum key distribution (QKD) d, HD, 
na, which has been extensively studied and now becomes 
practical in a metropolitan area fiber network d, EOl. QKD 
ensures the unconditional security in the sense that Eve can 
have unlimited physical abilities and computational power. 
Eor ESO channels which are basically line-of-sight (LoS) 
communications, however, this assumption is sometimes too 
much. The LoS condition can naturally relax the assumption 
for Eve. In fact, expected key rates of QKD in satellite-to- 
ground links are impractically poor if one insists on assuming 
that Eve can be everywhere in the universe and can do 
anything. Instead, one should exploit more practical schemes 
which can attain higher key rate for LoS ESO channels under 
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Fig. 1. Wiretap channel based on on-off keying (OOK) modulation. 


sensible assumptions case by case. 

Design theory for wiretap channel coding should hopefully 
be able to evaluate the reliability for Bob and the secrecy 
against Eve. Practically, the cost constraint at Alice’s side, such 
as the power and bandwidth constraint, is an important factor 
to be cared. In fact, transmission power should be carefully 
regulated so as not to increase wiretap risks. Furthermore, 
the performances should eventually be characterized in finite 
length coding for practical use. These issues have been partly 
dealt with in literatures m], ED, but insights into unihed 
theory and numerically expected performances have not been 
accumulated sufficiently yet, even in the idealistic setting of 
fading free channels. 


In this paper, we study the optical wiretap channels with 
linear attenuation and background noises based on the on-off 
keying (OOK) modulation. From the practical viewpoint, we 
impose the power constraint on Alice’s available transmission 
power. We numerically study the achievable secrecy rates and 
the secrecy capacity as a function of channel attenuation. We 
compare them with the secure key rate for QKD to show 
how the performance can be increased by compromising the 
assumption on Eve. According to the calculation, even if Eve 
can obtain 99% as much power as Bob, FSO links with ITS 
would be possible between geostationary earth orbit (GEO) 
satellites and ground stations with currently available tech¬ 
nologies. A functional meaning of auxiliary random variable 
originally introduced by Csiszar and Korner Qol to establish 
the rate region of the general wiretap channel is clarihed as a 
booster mechanism of the distance limit due to the auxiliary 
noises. We then apply a recent theory on the error and secrecy 
exponents by some of authors m to hnite length analysis on 
the optical wiretap channels. We show how the code length 
to reach the given required levels of reliability and secrecy is 
estimated via the finite length analysis. 


The paper is organized as follows. In Section we give 
the model and formulate the problems. In Section we 
present numerical results of an achievability rate (lower bound 
to the secrecy capacity) and the structure of optimal parameters 
and power regulation. Section IV includes analysis with the 
auxiliary random variable used at Alice. Section |V] describes 


the estimation of the necessary code length for the given 
required levels of performances via the hnite length analysis. 


The paper is concluded in Section VI 


II. Formulation of the model 

Throughout this paper, we consider a model of optical 
wiretap channel with linear attenuation and background noises 
based on on-off keying (OOK) modulation as shown in Fig. 
[T] This model consists of the main channel Wb with which 
Alice transmits a conhdential message to Bob and the wire- 
tapper channel We with which Eve attempts to observe the 
conhdential message. Bob and Eve receive the OOK signals 
by an on-off detector based on photon counting. The main 
and wiretapper channels are characterized by two parameters; 
the channel transmittances rjy and 77 ^, and the dark count rates 
(DCR) Xy [counts/sec] (cps) and [cps], respectively. In this 
work, we dare to assume that the channels are fading free, in 
order to derive potentially achievable performances in good 
propagation conditions. 

Alice is subject to the constraint with the maximum avail¬ 
able transmission power of P [W], and transmits on- and off- 
signals encoding symbols “ 1 ” and “ 0 ” with probabilities q 
and 1 — q, respectively. The on-signal “1” is conveyed by a 
laser pulse of width Ap [s] and an average photon number 
UA- The off-signal “0” is conveyed by the vacuum pulse. Bob 
and Eve receive the attenuated pulses of the average photon 
numbers ub = VyiT-A ue = respectively. Detector 

efficiencies are renormalized into the channel transmittances. 
In order to compare the fraction of power received by two 
parties, we introduce the relative transmittance rjzy = rjz/rjy. 
In the LoS scenario, rjzy < 1 can be valid. The detector time 
resolutions for Bob and Eve are finite, and assumed to be the 
same, A [s], for simplicity, and to be larger than the laser 
pulse width, i.e., A > Ap. This time resolution actually sets 
the maximum limit of repetition rate of optical pulses. 

The above channel model should be regarded as a practical 
reduction of Poisson channel m, ED, which assumes an 
arbitrary short time resolution A —0, i.e., an infinite detector 
bandwidth, and has been extensively studied in ||25]| . where 
the analytical formulas of the secrecy capacity were derived. 
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Fig. 2. Channel diagram of wiretap channel. 


In the following, we mathematically formulate the model 
mentioned above. 


A. Power constraint 


Alice needs to optimize the input probability q and the 
average photon number ua within the maximum available 
transmission power P. In this work, we consider an optical 
channel at a center frequency /o = 200 THz (wavelength of 
1.5 /im, which is eye safe and commonly used in optical fiber 
communications) with a certain bandwidth B [Hz]. The pulsed 
laser of Alice is assumed to be Fourier-transform limited, i.e., 
BAp = 1. The value of B must be larger than the detector 
bandwidth A“^. For simplicity, an average photon number at 
each frequency, n(/), of the on-signal pulse is assumed to be 
the same value ua within the bandwidth B. Thus the power 
per on-signal pulse is 

ffo+Bl2 riAhfn 

Pp= n{f)hfdf / UAhfdf = — -, (1) 

J—oo JfQ — B/2 

where h is Planck’s constant. The total power of the OOK 
transmission is then 

p _ Ap UAhfo 

J total — ^ ^ ^ ^ 


which must be constrained by the maximum available power 
P. Thus, we have the following power constraint; 


q 


nAhfo 

A 


< P. 


( 3 ) 


B. Channel matrices 

The symbols for Alice, Bob, and Eve are defined as x, 
y, and z, drawn from the binary random variables X, Y, 
and Z, respectively. The on-off detectors at Bob and Eve 
discriminate the signals by the absence or presence of counts 
as “0” or “1”. Since the system is assumed to be stationary and 
memoryless, the main channel Wb illustrated in Eig.j^can be 
fully described by the elementary channel with the channel 
matrix given as 

Wsim = l-e-^y^ =ay, 

Wb{1\1) = 1 - = by, 

and 

Wb{ 0\0) = = l-ay, 

1Eb(0|1) = = ^-by, 


Note that the OCR Xy is understood to include not only the 
dark counts of the detector but also the background noises 
in the main channel. Similarly, the elements of the channel 
matrix of the wiretapper channel We are given by 

lE£;(l|0) = l-e-^^^=a„ 

We{1\1) = 1 - = 6 ^, 

We{0\0) = = 1 - 0 ,, 

1E^(0|1) = = 1-5,. 


C. Channel capacity and secrecy rate 

In this subsection, we introduce necessary measures and 
formulas to evaluate the performance of our model. In partic¬ 
ular, starting with channel capacity, we provide the formula for 
achievable secrecy rate maximized over possible transmission 
strategies without the auxiliary random variable V. The se¬ 
crecy capacity is defined as the maximum achievable secrecy 
rate optimized also over the auxiliary random variable V in 
addition to the input variable X Go), because the additional 
randomness with V can be helpful for deceiving Eve especially 
when the wiretapper channel VFb is not worse than the main 
channel Wb, and hence can improve the secrecy rate. We will 
work on it later in Section |lV] 

Considering the standard channel coding without Eve, the 
maximum achievable rate of reliable transmission is called 
channel capacity, and is given by 

C' = max/(A;r), (4) 

Px 

where I{X;Y) is the mutual information between the random 
variables X and Y. The maximization is taken over all possible 
input probability distribution Px- 

In this paper, we extend the above definition slightly so 
that not only the input probability q but also the input signal 
intensity (the average photon number ua) are simultaneously 
optimized under the power constraint 0. Therefore, the 
channel IEb is not a given fixed matrix but a 2-by-2 matrix 
variable through the parameter ua to be optimized. The 
channel capacity is then defined as 

C = max fB{q, pa), (5) 

q,nA 

where 


fB{q,nA) =h 2 {{l - q)ay -f g(l - by)) 

- {1 - q)h2{ay) - qh2{by), (6) 

with the binary entropy function defined as 

/ 12 (g) = -glog2g- (1 - g)log2(l - g). (7) 

In the wiretap channel coding, we concern the asymptoti¬ 
cally maximum achievable secrecy rate of reliable transmis¬ 
sion to Bob while ensuring the ITS against Eve, which is 
defined in the form as ii 

Rs = max [I{X; Y) - I{X-Z)]. (8) 

Px 

To have a positive value of R^, the relation I{X;Y) ^ 
I{X; Z) should hold for any X, which means that the main 
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(a) Loss-independent region (a = 60 dB) 


(b) Noise-limited region (a = 90 dB) 
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Fig. 3. Contour plots of /s(g, as a function of input probability q and average photon number ng = rjyrijx of the received pulse, (a) The loss- 
independent region with a = — logj^Q riy = 60 dB. (b) The noise-limited region with a = 90 dB. The red circle and the white painted area in each plot 
represent the channel capacity C and the non-allowed region due to the power constraint, respectively. Parameter values: P = 10 mW, \y = 10 kcps, A = 1 
ns. 


channel Wb is better than the wiretapper channel We re¬ 
gardless of the input strategy. If this is the case, the wiretap 
channel is said to be more capable and the above quantity 
coincides with the secrecy capacity, which will be mentioned 
later in Section |IV] In this paper, we deal with general cases, 
not necessarily being more capable, by assuming that the 
wiretapper channel is not worse. It depends on Py, Ay, 
and Xz whether the wiretap channel is more capable or 
less capable. Now the similar extension for the simultaneous 
optimization of q and ua is made as 

Rs = max fBE{q,nA), (9) 

q.riA 

where 

fBE{q,nA) = fB{q,nA) - fE{q,nA), ( 10 ) 

and 

fsiq^nA) =/i2((l - q)az + q{l - b^)) 

- {1-q)h2{az) - qh2ibz)- (H) 

III. Numerical results oe channel capacity and 

SECRECY RATE 

It is generally difficult to derive a closed form expression 
for the channel capacity 0 and the secrecy rate Q except for 
simple channels such as a binary symmetric channel. Hence, 
we carry out the numerical optimization in order to obtain 
these quantities. Throughout this section, we adopt a set of 
parameters as follows: P = 10 mW, Ay = 10 kcps, Az = 1 
cps, A = 1 ns, where the value of the time resolution A 
corresponds to the maximum possible pulse repetition rate of 1 
GHz. Note that the above parameters represent the case where 
Alice and Bob have the transmitter and the detector which will 


be available at the current level of technology, respectively, 
whereas Eve may have a much less noisy detector. In this 
case, the wiretap channel is not more capable for all possible 
values of ua- 

A. Channel capacity 

In this subsection, we present basic results of the channel 
capacity when there is nothing to do with the wiretapper 
channel, discuss important features in our model, and prepare 
ourselves for the main analysis on the secrecy rate. 

Fig. [3] shows contour plots of the mutual information 
fB{q,nA) as a function of input probability q and average 
photon number ub = tjynA of the received pulse. The 
calculations are demonstrated for two typical cases, (a) for a 
sufficiently small attenuation a (short distance transmission) 
where an attenuation a is defined by a = — log^Q rjy, and 
(b) for a larger attenuation a (long distance transmission). 
From this figure, we can know how the channel capacity and 
the optimal q and ub (and hence ua) are determined as the 
attenuation a varies. The power constraint translated in terms 
of received power at Bob is represented by the left lower region 
below the boundary (red solid line), which is referred to as the 
allowed region. The channel capacity C, indicated by the red 
circle, can be found on this boundary line. The right upper 
region is not allowed by the power constraint, referred to as 
the non-allowed region. 

In Fig. [^a), the power constraint border (red line) crosses 
the plateau of the maximum value of fB{q,nA)- As the 
attenuation a increases (the amount of the received power pyP 
decreases), the non-allowed region (right-upper area) extends 
to the left-lower side. Unless the power constraint border gets 
out of the plateau of the maximum of /^(g, ua), the value of 
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Fig. 4. Channel capacity C as a function of attenuation a = — log^^Q rjy. The 
upper insets are the intensity-quadrature constellations for received signals 
in the loss-independent (left) region and the noise-limited region (right). 
Parameters: P = 10 mW, \y = 10 kcps, A = 1 ns. 



the channel capacity remains the same value, independent of 
a. In this region, Alice’s power is sufficient enough to transmit 
the signals such that Bob’s detector can well discriminate 
them, not limited by the noises. We refer to the region as 
the loss-independent region. 

When the power constraint border has once gotten out of the 
plateau of the maximum of /^(g, ua) as depicted in Fig. [^b), 
the channel capacity starts to decrease. One can see the optimal 
q should also decrease. This means that Alice had better to 
send the on-signal less frequently to be able to make the on- 
signal as bright as possible under the power constraint so that 
Bob’s detector can discriminate it from the noise background 
with high SNR. We refer to the region as the noise-limited 
region. 

Such behaviors can be explicitly seen in Fig. by the 
channel capacity C as a function of attenuation a. The optimal 
parameters n*g and q* are shown in Figs.andrespectively. 



In the loss-independent region, although n*g decreases as 
a increases. Bob can still have a sufficiently high SNR, 
hence the capacity is unchanged. The q* is about 0.5. In 
the noise-limited region, n*^ stays at a level of around 1 
photon/pulse so that the SNR for the received signals is not 
further degraded (keeping the distance between the on- and 
off-signals in the I-Q constellation diagram the same order as 
the noise distribution), while q* should decrease as a increases 
so that the power constraint is satisfied. The channel capacity 
decreases as a increases, according roughly to q*. 


B. Secrecy rate 

In this subsection, based on the analysis carried out in the 
previous subsection, we move onto the main analysis on the 
secrecy rate R^, and discuss the optimal strategy. 

Fig. 0 shows contour plots of fBE{<l,nA) as a function 
of input probability q and average photon number ns of 
the received pulse. Contrary to shown in Fig. 

1^ the function fBE{<l,nA) sharply decreases at large tib, 
which is intuitively understood that the bright pulse increases 
the information leakage against Eve. Moreover, the value of 
fBE{q,nA) can be negative, because Bob’s detector is much 
more noisy than Eve’s one, and hence the wiretap channel is 
not more capable. 

Eig. [7|a) is for the loss-independent region. The maximum 
of fBE{q, tiA) (red circle) is located inside the allowed region. 
Unless the power constraint border (red solid line) passes over 
this maximum to the left-lower side, the secrecy rate Rg can 
be realized at this maximum. Thus, the optimal parameters 
{q*,n\) satisfy the strict inequality as 


\hfo 


A 


<P: 


( 12 ) 


indicating that Alice should not use the available power fully 
but regulate the transmission power properly so as to prevent 
the confidential information from leaking against Eve. 

Similarly to the channel capacity, the secrecy rate begins 
to decrease when the power constraint border line has once 
passed over the maximum of /B£;(g, as shown in Eig. 
I^b). In this region, the secrecy rate is located on this border 
such that Alice should use all the available power to retain the 
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(a) Loss-independent region (a = 60 dB) (b) Noise-limited region (a = 90 dB) 



Ave. photon no. ub [photons/pulse] Ave. photon no. ub [photons/pulse] 










Fig. 7. Contour plots of fBE(Qi ^a) a function of input probability q and average photon number tib of the received pulse and input probability q. (a) 
The loss-independent region with a. = — log^Q r}y = 60 dB. (b) The noise-limited region with a = 90 dB. The red circle and the white painted ai'ea denote 
the secrecy rate i?s and the non-allowed region due to the power constraint, respectively. Parameters: P = 10 mW, r}zy = 0.95, \y = 10 kcps, Xz = 1 
cps, A = 1 ns. 



124.4 dB 



Fig. 9. Optimal average photon number of the input pulse for the 
secrecy rate Pg in Fig. Since the secrecy rate decreases to 0, the curves 
for r}zy = 0.9 and r}zy = 0.99 are shown up to a = 124.4 dB and 107.6 
dB, respectively. The solid line denotes the parameter for the case without 
Eve {r]zy = 0) which leads to the channel capacity C. 


Fig. 8. Secrecy rate as a function of attenuation a = — log;LQ rjy with 
various relative transmittances rjzy- Also shown for comparison are the cases 
where the available power at Alice is used up. Parameters: P = 10 mW, 
Xy = 10 kcps, Xz = I cps, A = 1 ns. 


necessary SNR. Thus, the optimal parameters {q*,n\) satisfy 
the power constraint with holding equality as 


* n\hfo 

^ A 


(13) 


In Fig. we calculate the secrecy rate Rg as a function of 
attenuation a taking the above consideration into account. As 
indicated in the figure, the secrecy rate decreases as the relative 


transmittance rj^y gets close to 1 which is the case where Eve 
receives the equal amount of power as Bob. Compared to the 
channel capacity denoted by the solid line, we can observe 
some unique features of the secrecy rate i?s in terms of the 
dependence on attenuation a. First, in the noise-limited region, 
Rs decreases rapidly at a certain threshold point. In this figure, 
i?S for rjzy = 0.9 and rj^y = 0.99 rapidly fall down to 0 at 
around a = 124.4 dB and 107.6 dB, respectively. Second, 
if the available input power is fully used up in the loss- 
independent region, Rs rapidly falls down to 0 as a decreases, 
equivalently the distance between Alice and Bob gets shorter. 

The optimal parameters n*g, and q* are depicted in 
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124.4 dB 



Fig. 10. Optimal average photon number of the received pulse for the 
secrecy rate Rq in Fig. 

124.4 dB 



Fig. 11. Optimal input probability q* for the secrecy rate Rq in Fig. 


Figs. Interestingly enough, in contrast to the secrecy 

rate itself, the behaviors of these parameters seem to be 
irrespective to relative transmittance r/zy. Fig. indicates that 
n\ increases as a increases in both the loss-independent and 
noise-limited regions, whereas for the channel capacity 
(solid line) stays constant. This means that, for the secrecy 
rate, Alice should properly regulate the input power according 
to the distance between Alice and Bob. Fig. shows the 
average photon number = rjyn*^^ of the received pulse. 
As seen from the figure, in the loss-independent region, n*^ 
is kept unchanged even if the attenuation varies, while this 
value slightly decreases but remains at few photons in the 
noise-limited region, so that only Bob can discriminate the 
received signal from the noises but Eve should not so. In 
contrast to the average photon number behaviors, the optimal 
input probability q* behaves in a way showing no signihcant 
difference between the secrecy rate 
and channel capacity, as shown in Fig. E] 

C. Secrecy rate of wiretap channel coding and secure key rate 
ofQKD 

In Fig. [T^ we show simultaneously in the same graph the 
secrecy rate obtained in the previous subsection and the secure 
key rate of QKD schemes. The secrecy rate measures a mes¬ 
sage rate of wiretap channel coding for one-way transmission. 



Fig. 12. Secrecy rate R^ and secure key rate of QKD (BB84 El protocol). 
Parameters for wiretap channel: P = 10 mW, Xy = 10 kcps, Xz = 1 cps, 
A = 1 ns. Parameters for QKD: pulse generation rate = 1 GHz, DCR of a 
detector =100 cps. 


while the secure key rate of QKD does a rate of key exchange 
with quantum channel and an authenticated public (classical) 
channel. The two schemes are based on different assumptions 
on Eve. Eig. 12 aims at showing how we can increase the 
rate and distance of ESO links with ITS by compromising the 
assumption on Eve within reasonable practical conditions. 

The curve labeled with “decoyed BB84” shows a theoretical 
prediction of the secure key rate via BB84 ifT^ employing the 
decoy-pulse method f2S\ . Here, we assume an ideal linear 
attenuation channel and a single photon detector with a repe¬ 
tition rate of 1 GHz and a DCR of 100 cps, which is a typical 
DCR for the current QKD systems. This figure indicates that 
the secure key rate rapidly falls down at a distance of 40 
dB attenuation, which is roughly the best link budget for a 
low earth orbit (LEO) to ground distance in optical space 
communications mi- Although quantum relay based on tele¬ 
amplification ll28l has been proposed for extending a QKD 
distance (see the curve labeled with “tele-amplified BB84”), 
the secure key rate is always sacrihced while extending the 
transmission distance. 


On the other hand, as shown in Eig. 12 the secrecy rate 
i?S (blue lines) can cover a wider range in which QKD hardly 
generates the secure key even for the relative transmittance as 
high as Tjzy = 0.99 for the case where Eve can obtain 99% 
as much power as Bob. Eig. [T^ shows ESO links with ITS is 
possible even at a = 80 dB which roughly corresponds to the 
best link budget for a GEO-ground distance. Consequently, 
wiretap channel coding is potentially a promising candidate 
for realization of the global scale secure network based on 
ESO communications. 


IV. Secrecy capacity 

In this section, we extend the analysis to full optimization of 
secrecy rate by introducing the auxiliary random variable V at 
Alice, as was formulated by Csiszar and Korner Eol and study 
the secrecy capacity. This scheme requires us to concatenate 
an additional channel Px\v ^ th® main channel Wb and 
the wiretapper channel We, respectively. We reformulate 
the previous tools, present numerical results, and clarify the 
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Fig. 13. (a) Channel diagram of the wiretap channel with an auxiliary random 
channel Px \v (b) Channel diagram of the concatenated channels Wg , Wg . 


functional meaning and quantitative effects of the auxiliary 
random variable V. 


A. Power constraint and channel matrices 

Similarly to the model in Section]^ Alice generates the on- 
and off-signals corresponding to encoding symbols “ 1 ” and 
“0” with probabilities q and 1 — q, respectively. Then, Alice 
inputs the sequences into the wiretap channel with picking a 
symbol and flipping it randomly. Here, the encoding and input 
symbols are modeled by the auxiliary random variable V and 
the input random variable X, respectively (more formally, the 
random variables form a Markov chain V-X-YZ). Since the 
number taken by the elements of the auxiliary random variable 
V need not exceed that of the input random variable X |29l, 
we consider the case where V, X, Y, and Z are all binary, 
as illustrated in Fig. 


13 


a). The auxiliary channel Px\v from 
V to X can be modeIe3 by the channel matrix elements with 
any constants 0 < a, 6 < 1 as follows; 


Px|y(l|0)=a, Px\v{m = b. 


(14) 


Then, the probability of the input pulse into the wiretap 
channel is 5 + = (1 — q)a + q{l — b) in each time slot. Thus, 
the power constraint of ([^ which is imposed on X is rewritten 
as 


< p, 

A ~ 


(15) 


Effectively, we can consider the concatenated channels 


from V to Y and from 14 to Z as shown in Fig. 13 b). 


Given the main channel Wb and the auxiliary channel Px\v^ 



Fig. 14. Comparison of maXa^b fgg{q,nA,a,b) with /s£;(<?, rrA) 
varying the input probability q. Parameters: ng = 3.2 X 10“^ photons/pulse, 
rjzy = 0.95, \y = 10 kcps, = 1 cps, A = 1 ns. 


the conditional probability of the concatenated channel 
can be written as 

WB{y\v)= ^Biy\x)Px\v{x\v). (16) 

a:G{0,l} 

The channel matrix of is given by 

FF+(1|0) = (1 - a)ay + ahy = a+, 1E+(0|0) = 1 - a+ 

kF+(l|l) = (1 - h)ay + bby = b+, 1E+(0|1) = l-b+. 

Likewise, the channel matrix of the concatenated channel 
is given by 

VF+(1|0) = (1 - a)a, + ab, = a+, VF^(0|0) = 1 - a+, 

1L+(1|1) = (1 - b)a, + bb, = bt, 1L+(0|1) = 1-5+ 


B. Secrecy capacity 

With the channel matrices given in the previous subsection, 
the secrecy capacity Cs is defined and computed as the 
simultaneous optimization over q, ha, a, and 5: 

Cs= max f;^g;{q,nA,a,b), (17) 

q,nAiCL-,o 

where the function fgg,{q,nA,a,b) is defined to be 

fBEiy^BA,a,b) = fB{q,nA,a,b) - /^(g,a,5), (18) 

and fQ{q,nA,a,b) and f^{q,nA,a,b) are the mutual infor¬ 
mations: 


f^{q,nA,a,b) =52((l-g)a+ -f g(l-5+)) 

- (1 - g)52(a+) - g52(5+), (19) 

f+{q,nA,a,b) =52((l-g)a+ -f g(l-5+)) 

- (1 - g)52(a+) - g52(5+), ( 20 ) 


where ua intervenes through ay^by^az^b^. 

we compare the function max^ xla, a, h) 


In Fig. 


14 


(solid line) optimized over a and b with fBE{q,nA) (dashed 
line) for a wiretap channel which is not more capable. The 
figure indicates that max^ JbeI^’ ^a, a, b) is strictly positive 
for any input probability g G { 0 , 1 } whereas /B£:(g,nyi) be¬ 
comes negative for small g. Moreover, maxa,b /be(9: pa, a, 5) 
is larger than fBE{q,nA) at any input probability g G { 0 , 1 }. 
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Fig. 15. (a) Secrecy capacity Cg as a function of attenuation a = — logj^Q r]y. Also shown for comparison are the secrecy rate Rg. Parameters: P = 10 

mW, \y = 10 kcps, Az = 1 cps, A = 1 ns. (b) Optimal cross-over probabilities Px|v(l|0) = Px|v(0|l) = 1 — b for rj^^y = 0.99. 


The extension in the transmission distance which will be 
shown later should be attributed to this increase of the value 
caused by the auxiliary random variable V. 

C. Numerical evaluation 

In this subsection, we numerically demonstrate the improve¬ 
ment of transmission distance due to the concatenation of the 
auxiliary channel Px\v- In Fig.[T5|a), we compare the secrecy 
capacity Cs (solid lines) based on with the secrecy rate 
i?s (dashed lines) based on which was investigated in 
Sections [I^ and III (see Fig. [8i. According to the figure, the 
auxiliary random variable V brings about the improvement 
of transmission distance in the noise limited region, e.g., for 
r]zy = 0.99, the attenuation a at which the secrecy rate 
sharply falls is improved by 6 dB, which is equivalent to 40% 
extension of the transmission distance. This effect becomes 
significant for larger values of the relative transmittance rj^y 

Fig. [^b) shows the optimal cross-over probabilities 
-fx|y(l|0) = a and Px|y(0|l) = 1 - 6 for = 0.99 in 
Fig. [^a). Here, Fx|y(l|0) is the probability of flipping “0” 
(off-signal) into “1” (on-signal) and Px|y(0|l) is vice versa. 
As seen in Fig. [T5|b), Px|y(l|0) is non-zero and increases 
drastically in the noise-limited region, whereas Px|y(0|l) 
stays 0. 

The effect of the auxiliary randomness generated at the 
sender on the performance has been investigated especially 
in the multiple receivers scenario lEoi, lEa, ini, namely, the 
artificial noise is created such that it degrades Eve’s channel 
but does not affect the main channel through the use of the 
interference effect among the receivers. In contrast to such 
studies. Fig. [Bib) reveals that the addition of the random 
pulses has a crucial role in the proposed method. In our 
case. Eve who may have the less noisy detector than Bob 
can be further deceived by the dummy pulses which act as 
extra noises, and the performance is enhanced. This means 
that the proposed method bears a remarkable resemblance to 
the decoy method employed in BB84 ll26l . In this method, 
Alice varies the average photon number of each signal pulse 
randomly among the prescribed levels, thus Eve is prevented 
from wiretapping the signal pulses, and the security and the 
transmission distance is boosted. 


Code length n 


◄-► 







Message bit m 

Randomness 

Redundant 


bit I bit 


Fig. 16. Conceptual codeword structure of a wiretap channel code. 


V. Einite length analysis 


A. Formulation 

Although the secrecy capacity investigated in the last section 
is considered as a reasonable benchmark of the system, it 
concerns only the achievable rate in the asymptotic limit 
at code length n —i' oo and contains no information about 
practical code construction of finite length n. In this section, 
in order to estimate required resources for the given levels of 
reliability for Bob and secrecy against Eve, we introduce a 
stronger characterization showing how fast the decoding error 
probability and the leaked information decrease. 


As depicted schematically in Eig. 16 a wiretap channel 


code consists of three types of bits, i.e., m bits conveying 
the confidential information, I bits as the random dummy 
information to deceive Eve, and n — m — I redundant bits to 
perform error correction. Here, let Rb = mjn and Re = I/n 
be the coding rate and the randomness rate, respectively. 

Eor such a code, we introduce the measures on the decoding 
error probability and the leaked information 6^. Given an 
output via the main channel due to message i from the message 
set Ain, Bob computes an estimate i of message i with his 
decoder. The decoding error probability is measured as 

ieMn 




\Mr 


where |A4„| denotes the number of messages included in A4„ 
and Pr{ } denotes the probability of an event. Also, the leaked 
information 6n against Eve is measured as 

1 


S^ = 


\Mr 




( 22 ) 


ieMr, 
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(a) (b) 



Fig. 17. Code length dependence of (a) error probability and (b) leaked information The coding rate is fixed as to be Rq = O.bRs = 22.1 Mbps 
(see Fig. [^. The an'ows denote the change of the code length dependence when the randomness rate decreases by 1% from = 0.641 Gbps. 

TABLE I 

Rates and exponents eor FiG.fTT] 



Re [Gbps] 

R*g +Re [Gbps] 

Fc(q, Rb,Re) 

Hc{q,RE) 

Re = R% 

0.641 

0.663 

1.59 X 10“"^ 

1.59 X 10“^ 

Re = 0.99R*g 

0.634 

0.656 

4.00 X 10“"^ 

0.29 X lO”"^ 

Re = 1.01R*g 

0.647 

0.669 

0.28 X 10“"^ 

3.94 X lO”"^ 


where D(Pn'^\\TTn) is the Kullback-Leibler distance ||29]| be- 
tween the output probability distribution Pn via the wiretap¬ 
per channel due to message i and the target output probability 
distribution 7r„ which is generated via the wiretapper channel 
due to an arbitrarily prescribed input distribution. 

According to the theory of wiretap channel coding im, 
there exists a code with length n attaining the following upper 
bounds on the error probability e® and the leaked information 
5 ^- 

^71 ' 

ef < (23) 

where the exponents Fc{q, Rb, Re) and Hc{q,RE) are re¬ 
ferred to as the error exponent and the secrecy exponent 
defined as 


Fc{q, Rb,Re) 

= sup sup [(l>{p\WB,q,r) - p{Rb + Re)] , (24) 

r>0 0<p<l 

Hc{q, Re) 

= sup sup [(j){-p\WE, q, r) + pRs] , (25) 

r>0 0<p<l 


respectively. It is known that the error exponent Fc{q, Rb, Re) 
is a monotone strictly positive decreasing in Rb + Re < 
I{X;Y) and becomes 0 for Rb + Re > I{X',Y). Con¬ 
versely, the secrecy exponent Hc{q, Re) is a monotone strictly 
positive increasing in Re > I{X;Z) and becomes 0 for 
Re<I{X-Z). 

Here, (j){p\WB,q,r) in (24i and (l){—p\WE,q,r) in (25l 
are functions of the given channels Wb,We and the input 
probability q. For the wiretap channel based on the OOK 
considered in this paper, these functions are given as in (261 
and ( [Z7| at the top of the next page. The arbitrary constant 
r > 0 is optimized so that each exponent be maximized. The 


authors of ETIl have derived exponents for the wiretap channel 
with the auxiliary channel Px\v- In this paper, however, we 
only pay attention to the wiretap channel without Px\v for 
simplicity. 


B. Code length dependence of error probability and leaked 
information 

For a practical code of finite length n, the coding rate 
Rb cannot be arbitrarily close to the secrecy capacity (or 
secrecy rate), as well as the error probability and the leaked 
information 6^ cannot be infinitesimally small. In order to 
design the practical wiretap channel codes, the coding rate 
Rb should be compromised to be much lower than the secrecy 
capacity, and then the necessary code length n for the required 
levels of and 6^ should be investigated. This is actually 
the motivation to introduce the error exponent Fc{q, Rb, Re) 
and the secrecy exponent Flciq, Re) lf3^ . If33l . O?! . Although 
some previous studies (e.g. 1251 ) have revealed that the secrecy 
capacity can be asymptotically achieved with constructive 
codes, the evaluation of both and for finite length codes 
has never been investigated to our best knowledge. 

we show the upper bounds on and based 
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In Fig. 

on (j2^ choosing the case of the loss-independent region with 
a = 70 dB and = 0.9. We again adopt a set of parameters 
as P = 10 mW, Xy = 10 kcps, Az = 1 cps, A = 1 ns, which 
are the same as in Section m The secrecy rate Rs is 44.2 
Mbps and the optimum parameters are = 1.94 x 10^, 
q* = 0.544 (see Figs. §0 and [11). 

We fix the coding rate Rg = 22.1 Mbps as to be the half 
of the secrecy rate Rg. The solid line denotes the case of 
R*g = 0.641 Gbps which is set so that F(,{q, Rg, R*e) = 
Hc{q,R*E) = 1.59 X 10“"^ as shown in table [^ As seen in 
this figure, both and begin to decrease rapidly over 

















II 


(j){p\WB,q,r) 


= - log 


r4- r P- 


e 


(P-^) 


+ {1 - q)ay-^'‘+ (q{l - by) ^+p f ' 




\ 1 +p' 

+ {l-q){l-ay)T^e^n 


(t>{-p\WE,q,r) 


= - log 


1 r P- 


i'l/o 


1-p 


1 r P- 


qbl'’e^ / + (1 - g)ai '’e*' + q(l - 6^) i-p e V y + (i _ g)(i _ i-p e 


4^/0 


^rP 


(26) 

i-p- 

I 

(27) 


n = 10"* and reach the standard error-free criterion < 10“® 
and the leaked information criterion < 10“® at around 
n = 10®, which is the reasonable code length compared 
with the current technology. In the standard channel coding 
without Eve, can be reduced arbitrarily by lowering the 
coding rate Rb with fixing the code length. However, in the 
wiretap channel coding, since Re should be kept larger than 
the mutual information I{X\Z) for the secrecy against Eve, it 
is not obvious whether there is a code of reasonable length n 
which satisfies the required levels of both and 5^. Eig. 17 


provides the significant knowledge on this point, namely, even 
for the relative transmittance pzy = 0.9 which corresponds 
to the case where Eve can wiretap much power, there is a 
practical code with sufficiently small and S^. 


In Eig. the dashed line labeled with “Re = 0.99R%” 
illustrates the case where Re set to be 99% of R’^. As 
shown in table Fc{q, Rb, Re) increases compared to the 
case of R*^ because of its monotonicity in Rb + Re- This 
brings a decrease in e® as denoted by the arrow in the 
figure. On the other hand, Hdq, Re) decreases because of its 
monotonicity in Re and increases. As seen in the figure, 
reaches 10“® around at n = 7 x 10^, which is shorter than 
the case of R'^. On the other hand, 6^ reaches only 10“^ 
with this code length. In order to reach < 10“®, a much 
longer code length of n > 9 x 10® is required. In contrast to 
the above case, the dotted line labeled with “Re = l.Oli?^” 
illustrates the case where Re is set to be 101% of R*^. In 
this case, increases whereas 5^ decreases as shown in the 
figure. 


Intuitive examples of the above discussion are as follows; 
in order to relax the implementation cost of codes, one may 
wish to change the criteria for the secrecy according to the 
level of confidentiality of information. In the opposite case, 
more secure codes may be required to establish secure links 
leaving the complexity of implementation out of consideration. 
The discussion in this subsection provides the quantification 
of such an adaptive change of the performances. In other 
words, we characterize another clue for controlling the tradeoff 
between performance and code length via the upper bounds in 
which is more practical than other examples of tradeoff 
relation provided in IItTI . Il22ll . 


VI. Conclusion 

In this paper, we have studied the performance of physical 
layer security of ESO communications based on the OOK 
modulation with linear attenuation and background noises, 
using the secrecy capacity and the code length dependence 
of the error probability and the leaked information as per¬ 
formance metrics. Although we have mainly focused on the 
idealistic setting, i.e., without fading, we have numerically 
shown that the global scale network with ITS would be 
potentially realized by wiretap channel coding with currently 
available technologies and there exists a wiretap channel code 
of a practical length. 

We have numerically investigated the secrecy rates and the 
secrecy capacity and clarified its unique features as follows; 
(a) unless the transmission power is regulated optimally, these 
quantities dramatically drop in the small attenuation region 
and (b) transmission distance of our proposed method can be 
much longer than that of QKD even when Eve can obtain 99% 
as much the fraction of power as Bob. We have also shown 
that the transmission distance can be extended by introducing 
the auxiliary random variable V at Alice nni if the wiretap 
channel is not more capable. The random additional pulses 
resulting from the auxiliary channel Px\v pl^Y essential 
role in deceiving Eve when the SNR at Bob is worse, which 
implies the similarity to the decoy method employed in QKD. 
This physical implication of the effect of the auxiliary random 
variable has not been explicitly demonstrated so far. 

Eurther, on the basis of the past theoretical study IItTII . we 
have introduced the error exponent Fc{q, Rb, Re) and the 
secrecy exponent Hc{q,RE) for our proposed method. We 
have provided the characterization of such exponents in terms 
of the code length dependence of the error probability 
and the leaked information S^. The code length dependence 
of and 6^ provides (a) the evaluation of and 6^ for 
practical codes of finite length and, (b) the necessary code 
length to satisfy the required levels of both and S^. Our 
calculation has indicated the existence of a practical code with 
the reasonable length and the sufficient performance even for 
the case where Eve can obtain 90% as much power as Bob. 

There might be many interesting problems left open. We 
mention two of them. Eirst, our analysis should be extended to 
include the fading effect. The received signal intensity through 
a typical ESO channel fluctuates in a time scale of millisecond 
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due to atmospheric scintillation. A straightforward way is to 
model this fluctuation by renormalizing the noise variance in a 
log-normal fading distribution, which leads to the degradation 
of overall performances. A more sophisticated approach is 
an adaptive scheme. If the CSI can be estimated by Alice, 
the transmission power can be allocated opportunistically to 
the instantaneous fading realizations for which Eve obtains a 
lower instantaneous SNR than that of Bob. As a result, strictly 
positive secrecy rates are achievable even if, on average. Eve 
obtains a better SNR than that of Bob ifTTl . ifT^ . However, 
this adaptive scheme requires a fast feedforward mechanism 
in the millisecond time scale, and remains a challenge. 

Second and the last, multiple colluding eavesdroppers are a 
likely risk in an ESO link. One can easily imagine that multiple 
drones tap various places in the ESO link, and collude for 
getting information. Countermeasures should not be simple, 
and be sought from the viewpoint not only of coding schemes 
but also of system level solution like monitoring and alarming 
functions. 

In spite of such a challenging problem to which we should 
address in the future, we believe that the potential perfor¬ 
mances of physical layer security of ESO communications 
presented in this paper provide insight into a new direction 
for secure communications. Eor example, it is noteworthy that 
performances of physical layer security of ESO channels and 
QKD are regarded as complementary technologies in the sense 
of the tradeoff between security level and usability. Thus, they 
will eventually be integrated to realize high capacity optical 
communications with ITS and such a combination should 
provide the new paradigm of secure communications. 
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